Privacy notice

Who is responsible for your data

The controller of your personal data is the owner of ArcadiaSMP, an individual based in the United Kingdom. To contact us, email officialarcadiasupport@gmail.com or open a support ticket in our Discord. ArcadiaSMP is run by one person with volunteer staff; staff see data only where their role needs it.

What we collect, why, and our lawful basis

Data	Where it comes from	Why	Lawful basis (UK GDPR Art 6)
Email, website name, password (stored only as an argon2id hash), optional two-factor secret (encrypted)	You, when you register	To run your account and keep it secure	Contract
Whether you confirmed your email address; the one-time links we email you (stored only as a one-way hash), when each was sent, used or ran out, and the IP address that asked for it	You, when you register, confirm your address or ask to reset your password	To confirm your address, let you reset a forgotten password and tell you when your password changes	Contract; legitimate interests (account security)
Minecraft UUID and name	You link it with an in-game code; our game server reports it	To deliver purchases and show your rank	Contract
Discord user id and name (only if you link Discord)	Discord, with your permission ("identify" scope only; we do not keep Discord access tokens)	To give you Discord roles and, if you switch them on, game alerts by Discord message	Contract (roles); consent (alerts, off by default)
The account-linking reward: the Minecraft UUID it went to and a one-way hash of the Discord id (only if you link both)	Your linked accounts	To give the one-time reward once per Minecraft and Discord account, also after an account is deleted	Legitimate interests (preventing the reward being claimed again)
Orders: package, amounts, currency, status, Stripe references, the Minecraft account they went to	You and Stripe	To take payment, deliver Coins, handle refunds, disputes and complaints	Contract; legal obligation (tax and accounting records)
What you agreed to at sign-up and checkout, with the wording, version and time	You	Proof of the agreement and of your request for immediate delivery	Legal obligation; legitimate interests (handling disputes)
Stripe event data: your name, email, billing country or address, card brand and last four digits	Stripe	To confirm payments and refunds	Contract; legal obligation
Game statistics (playtime, kills, blocks mined and similar counters), rank, first and last seen	Our game server	Public leaderboards and profiles	Legitimate interests (a community leaderboard players expect); you can hide your profile
Moderation records (warnings, mutes, bans, Discord moderation cases), support tickets and suggestions	Staff, you (tickets, suggestions)	Keeping the community safe, handling appeals and support	Legitimate interests
Security data: IP address, browser (user agent), sign-in times and an activity log	Your browser	Preventing fraud, abuse and account takeover	Legitimate interests
Your spending limit and alert preferences	You	Doing what you asked	Contract

We do not ask for your date of birth or age. We do not collect special category data on purpose. We do not use your data for advertising, sell it, or make decisions about you by automated means that have legal or similarly significant effects. Fraud and rate limits are simple automatic rules (for example, too many sign-in attempts); a person reviews any account action that follows.

Public information

Your Minecraft name, skin picture, rank, game statistics, first and last seen time, whether you are online, and whether your Minecraft account is linked to a website account can appear on public player profiles, leaderboards and in search. The website does not publish Coin balances or coinflip and jackpot results. In game, other players can see Coin balances with /coins <player> and /coins top. You can hide your profile, leaderboard entries and search results on your account page; deleting your account hides them too. Suggestions you post in our Discord are public there.

Who we share it with

• Stripe (payments, tax calculation, receipts). Stripe acts as an independent controller for payment and fraud checks. Stripe's privacy notice.
• Discord (only if you link it or use our Discord). Discord's privacy policy.
• mc-heads.net: our server asks it for skin pictures using your Minecraft UUID; your browser does not contact it.
• Our hosting provider, which stores the website and its database for us under contract.
• Our email provider, which delivers our account emails for us under contract: confirming your address, password reset links and "your password was changed" notices. It receives your email address, website name and the email itself. We send no marketing emails.
• Our game server, which we run ourselves, exchanges purchase deliveries, link codes, statistics and moderation actions with the website over a signed connection.
• Authorities, where the law requires it or to protect someone's safety (for example reporting child-safety concerns).

International transfers

Stripe, Discord and our email provider may process data in the United States and elsewhere. These transfers rely on the UK's adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Agreement / Addendum in the provider's terms. If our hosting provider stores data outside the UK, the same kinds of safeguards apply.

How long we keep it

Data	How long
Sign-in sessions	30 days, or until you sign out
Link codes; sign-in attempt counters	About 1 day
Email links (confirming your address: 24 hours; password reset: 1 hour)	Until they are used or run out, then 1 more day
The record that an account email was sent (which kind, when; not its content)	30 days (90 days if it could not be sent)
Stripe event details (names, emails, addresses, card summary)	90 days, then only the event id and outcome are kept
Checkouts that were never paid	90 days
Game event log; weekly statistics history	90 days; 40 days
IP addresses in the activity log	12 months
Activity log entries	24 months
Closed Discord support tickets (the record of them)	12 months
Paid orders, refunds, payment records and purchase agreements, and other records of what you agreed to	6 years after the end of the tax year of the purchase or agreement (tax and accounting law), then deleted; the record of the Terms you currently agree to is kept while your account exists
Moderation records (warnings, kicks, mutes, bans, Discord moderation cases)	2 years after the punishment ended (it expired or was lifted; warnings and kicks from when they were given), then deleted. A permanent ban or mute is kept while it is in force
Your account	Until you delete it
Backups	Up to 14 days

Your rights

You have the right to: get a copy of your data (download it from your account page); have it corrected; have it deleted (delete your account on your account page); object to processing based on legitimate interests (for example, hide your public profile); restrict processing; and data portability. Where we rely on consent (Discord alerts), you can switch it off at any time. We reply to requests within one month. To ask, email officialarcadiasupport@gmail.com or open a support ticket in our Discord.

What deleting your account does: it removes your email, password, two-factor setup, linked accounts, preferences and sessions, and hides your public profile. We keep paid orders, refunds and purchase agreements (tax law and possible disputes), and moderation records (safety), linked to an anonymous account record. Coins and items in the game belong to your Minecraft account and are not affected.

Children

Many players are under 18. We apply the same high-privacy settings to everyone: no tracking or advertising, no sharing for marketing, Discord alerts off by default, Coin balances not shown on the website, and profiles you can hide. If you are under 13, ask a parent or guardian to read this notice with you. Parents and guardians can contact us about a child's data.

Security

Passwords are hashed with argon2id; two-factor secrets are encrypted; the session cookie cannot be read by scripts; staff need two-factor authentication; the database is not reachable from the internet; payment details are handled by Stripe only. Password reset links work once, for 1 hour, and signing in afterwards still needs your two-factor code. If a personal data breach is likely to put you at risk, we will tell you and, where required, the ICO within 72 hours.

Cookies

See the Cookie policy. We only use one cookie, which is needed to keep you signed in.

Complaints

You have the right to complain to us about how we use your data: email officialarcadiasupport@gmail.com or open a support ticket in our Discord and say it is a data protection complaint. We acknowledge it within 30 days, look into it without undue delay and tell you the outcome.

You can also complain to the UK regulator, the Information Commission (ICO, formerly the Information Commissioner's Office): ico.org.uk/make-a-complaint, 0303 123 1113.

Changes

We will update this notice when what we do changes. The version date is at the top.